Synopsis

wireshark security update

Type/Severity

Security Advisory: Low

Topic

New Wireshark packages that fix various security vulnerabilities are now
available. Wireshark was previously known as Ethereal.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Description

Wireshark is a program for monitoring network traffic.

Bugs were found in Wireshark's SCSI and SSCOP protocol dissectors. Ethereal
could crash or stop responding if it read a malformed packet off the
network. (CVE-2006-4330, CVE-2006-4333)

An off-by-one bug was found in the IPsec ESP decryption preference parser.
Ethereal could crash or stop responding if it read a malformed packet off
the network. (CVE-2006-4331)

Users of Wireshark or Ethereal should upgrade to these updated packages
containing Wireshark version 0.99.3, which is not vulnerable to these
issues. These packages also fix a bug in the PAM configuration of the
Wireshark packages which prevented non-root users starting a capture.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Server 2 ia64
• Red Hat Enterprise Linux Server 2 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Workstation 2 ia64
• Red Hat Enterprise Linux Workstation 2 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 204045 - CVE-2006-4330 Wireshark security issues (CVE-2006-4331 CVE-2006-4333)
• BZ - 204066 - wireshark doesn't work as non root user

CVEs

• CVE-2006-4333
• CVE-2006-4330
• CVE-2006-4331

References

• http://www.wireshark.org/security/wnpa-sec-2006-02.html
• http://www.wireshark.org/faq.html#q1.2
• http://www.redhat.com/security/updates/classification/#low

Red Hat Enterprise Linux Server 4

SRPM
x86_64
wireshark-0.99.3-EL4.2.x86_64.rpm	SHA-256: a490cb696b9cdc70c7433fce4403f6b0eca4b9f4075c6ccb2ae4b58a4bf45607
wireshark-0.99.3-EL4.2.x86_64.rpm	SHA-256: a490cb696b9cdc70c7433fce4403f6b0eca4b9f4075c6ccb2ae4b58a4bf45607
wireshark-gnome-0.99.3-EL4.2.x86_64.rpm	SHA-256: d85f2d7ba9dc76571aa996082a6b12d73f76441b2902c1c4d77c4dfcf46cf78d
wireshark-gnome-0.99.3-EL4.2.x86_64.rpm	SHA-256: d85f2d7ba9dc76571aa996082a6b12d73f76441b2902c1c4d77c4dfcf46cf78d
ia64
wireshark-0.99.3-EL4.2.ia64.rpm	SHA-256: ab9329abddb8b9e7d36ef2e3f47c5bf025d2af408be8431bf37a6e5dca3e3ddd
wireshark-0.99.3-EL4.2.ia64.rpm	SHA-256: ab9329abddb8b9e7d36ef2e3f47c5bf025d2af408be8431bf37a6e5dca3e3ddd
wireshark-gnome-0.99.3-EL4.2.ia64.rpm	SHA-256: 2164ee1d167d178055968329fb5190fa1c30762c8901321438a69865206301fd
wireshark-gnome-0.99.3-EL4.2.ia64.rpm	SHA-256: 2164ee1d167d178055968329fb5190fa1c30762c8901321438a69865206301fd
i386
wireshark-0.99.3-EL4.2.i386.rpm	SHA-256: eec2be04a3c860dad16674e0322853d597d3084b19d0db459d5788b9d13b2942
wireshark-0.99.3-EL4.2.i386.rpm	SHA-256: eec2be04a3c860dad16674e0322853d597d3084b19d0db459d5788b9d13b2942
wireshark-gnome-0.99.3-EL4.2.i386.rpm	SHA-256: fa83171ad5c9322b1a0306a83737497438641d2bb9e2ade4b419d9b6f0b2b1c9
wireshark-gnome-0.99.3-EL4.2.i386.rpm	SHA-256: fa83171ad5c9322b1a0306a83737497438641d2bb9e2ade4b419d9b6f0b2b1c9

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
wireshark-0.99.3-EL4.2.x86_64.rpm	SHA-256: a490cb696b9cdc70c7433fce4403f6b0eca4b9f4075c6ccb2ae4b58a4bf45607
wireshark-gnome-0.99.3-EL4.2.x86_64.rpm	SHA-256: d85f2d7ba9dc76571aa996082a6b12d73f76441b2902c1c4d77c4dfcf46cf78d
ia64
wireshark-0.99.3-EL4.2.ia64.rpm	SHA-256: ab9329abddb8b9e7d36ef2e3f47c5bf025d2af408be8431bf37a6e5dca3e3ddd
wireshark-gnome-0.99.3-EL4.2.ia64.rpm	SHA-256: 2164ee1d167d178055968329fb5190fa1c30762c8901321438a69865206301fd
i386
wireshark-0.99.3-EL4.2.i386.rpm	SHA-256: eec2be04a3c860dad16674e0322853d597d3084b19d0db459d5788b9d13b2942
wireshark-gnome-0.99.3-EL4.2.i386.rpm	SHA-256: fa83171ad5c9322b1a0306a83737497438641d2bb9e2ade4b419d9b6f0b2b1c9

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
wireshark-0.99.3-EL4.2.x86_64.rpm	SHA-256: a490cb696b9cdc70c7433fce4403f6b0eca4b9f4075c6ccb2ae4b58a4bf45607
wireshark-gnome-0.99.3-EL4.2.x86_64.rpm	SHA-256: d85f2d7ba9dc76571aa996082a6b12d73f76441b2902c1c4d77c4dfcf46cf78d
i386
wireshark-0.99.3-EL4.2.i386.rpm	SHA-256: eec2be04a3c860dad16674e0322853d597d3084b19d0db459d5788b9d13b2942
wireshark-gnome-0.99.3-EL4.2.i386.rpm	SHA-256: fa83171ad5c9322b1a0306a83737497438641d2bb9e2ade4b419d9b6f0b2b1c9

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
wireshark-0.99.3-EL4.2.s390x.rpm	SHA-256: 9a268bc1188318d58196866d87fa8285eb84bd03005beb88c13b99ed66a1d92c
wireshark-gnome-0.99.3-EL4.2.s390x.rpm	SHA-256: 08ab924eb24b4eb5079a23fcde81af5df795d7d8a8f8698093312f30b4a9a3b8
s390
wireshark-0.99.3-EL4.2.s390.rpm	SHA-256: 7a64f3763e6fe1065d3f8f245409df810d95ccc55a56b778cbd4267e01008a81
wireshark-gnome-0.99.3-EL4.2.s390.rpm	SHA-256: fb228f3bc15ff11e5dd5515f0032a99cc60856d43d3474635c84086fbdb56772

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
wireshark-0.99.3-EL4.2.ppc.rpm	SHA-256: 76005c081787094b337a6d810d7a206d0903b8369754b89ef15c65a925ec3dd3
wireshark-gnome-0.99.3-EL4.2.ppc.rpm	SHA-256: 6bd5bd91a4c6dd97bfad4c964e0be22029d0bfa263036eb6e322be00bc073d68